Privacy Policy

At Like Magic, we respect the privacy of our corporate clients, their administrators, and their employees. This Privacy Policy details how we collect, process, secure, and store personal information in strict compliance with the Protection of Personal Information Act, No. 4 of 2013 ("POPIA") of South Africa.

1. Information We Collect

Like Magic operates as a dual-role entity. We act as a Responsible Party for information provided directly by corporate clients during account registration, and as an Operator (processing data on behalf of our corporate clients) when collecting telemetry from employee workstations via the Like Magic Desktop Agent.

• Account Registration & Billing Information: Full name, email address, password hashes, company name, custom domain mappings, and billing tokens (processed securely via external payment gateway integration).
• Employee Telemetry (Operator Role): Keystroke counts (volume stats only), mouse click counts (volume stats only), active foreground application executable names, and the window titles of the active foreground window.

2. What We Explicitly DO NOT Monitor

To preserve employee dignity, privacy, and confidentiality, the Like Magic Desktop Agent is programmatically restricted. We do not collect:

• Individual keystroke content (no raw letters, symbols, passwords, or communications are logged).
• Webcam or microphone feeds.
• Screenshots or real-time screen recordings.
• Local file contents or network telemetry.
• Physical location GPS coordinates.

3. Purpose of Processing

All data processed under the platform is done so strictly for the following purposes:

• To calculate aggregate employee active work times, idle break times, and meeting statistics.
• To provide company administrators with high-level efficiency dashboards.
• To process subscription payments, prevent fraud, and manage account licensing.
• To send critical system updates, service alerts, and security notifications.

4. Information Security Measures

We implement robust technical and organizational security controls to protect personal information against unauthorized access, loss, or alteration. Data is encrypted in transit using SSL/TLS and at rest using database-level security. Access to tenant data is isolated strictly to authenticated users of that specific tenant company.

5. Data Retention & Third Parties

Customer data is retained only for as long as the subscription remains active, or until a formal deletion request is made by the customer administrator. Session telemetry is purged automatically after 1 year. We do not sell, rent, or lease employee telemetry to third parties.

6. User Rights Under POPIA

In terms of POPIA, data subjects (administrators and employees) have the right to request access to, correction of, or deletion of their personal information. All such requests should be directed to the designated Information Officer listed below.